dependabot-maven 0.392.0 → 0.393.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7384e20ca998f4af49001eb34de080505f3abff092e4faa921424ad6b65299e
-  data.tar.gz: 3c7f12c0289d6a8e811d0d51c6d24af81a319e59ba722fe773d623433ddb6ab9
+  metadata.gz: fff231d12e4c6ebdbdbf645bcc82c18a7b895ecc870ddb6aba549e4296f0ead6
+  data.tar.gz: a0c24d6534e7bd9c48e7256bd6f03176713f75173f523ac75a8f389b022cc7ff
 SHA512:
-  metadata.gz: f8da50ec13cdb3fead27bd2e0c20e019650a8f38a9817be6fb17f8ec5ceef8b7ffb19b7e6805a7f40787de1c4d029d7692e35149a1fc10901d2f48d043c4a02b
-  data.tar.gz: f6f258473e1bff627f213be788e692c6ddfaced18172fdc6910307f504c12554ed88b5447163932e4d909b9be856aaa5921669e1f572de0e81c3ff6d865781a5
+  metadata.gz: 96a5bc8b3c845098794cec76a15763afde0d7b1d31caec84daf558d031a560fbd954d068b115dc9c0ba3a43806619d1d104f68b2d07ecd98c161c1d6bf3e99d1
+  data.tar.gz: fa5d05a001407b8dcfc41c530caacb1b547c60a42831ca9bfdb6aa6ec6983c1d63178c5d4429a8450aaedbac1f51ad48c747d3f4c4e498054b2564842fe55f93

data/lib/dependabot/maven/package/package_details_fetcher.rb

@@ -35,6 +35,8 @@ module Dependabot
           @repository_finder = T.let(nil, T.nilable(Maven::FileParser::RepositoriesFinder))
           @repositories_cache = T.let(nil, T.nilable(T::Array[RepositoryDetails]))
           @package_details = T.let(nil, T.nilable(Dependabot::Package::PackageDetails))
+          @release_date_cache = T.let({}, T::Hash[String, T.nilable(Time)])
+          @fallback_logged = T.let(false, T::Boolean)
         end
 
         sig { override.returns(Dependabot::Dependency) }
@@ -71,6 +73,25 @@ module Dependabot
           fetch.releases
         end
 
+        sig { params(release: Dependabot::Package::PackageRelease).returns(Dependabot::Package::PackageRelease) }
+        def fetch_release_metadata(release:)
+          return release if release.released_at
+
+          url = release.url
+          return release unless url
+
+          cache_key = "#{url}\0#{release.version}"
+          released_at = if @release_date_cache.key?(cache_key)
+                          @release_date_cache[cache_key]
+                        else
+                          @release_date_cache[cache_key] =
+                            fetch_pom_last_modified(repository_url: url, version: release.version)
+                        end
+          return release unless released_at
+
+          build_release_with_date(release, released_at)
+        end
+
         # Assembles the list of Maven repositories to search: credential repos + POM repos.
         sig { override.returns(T::Array[RepositoryDetails]) }
         def repositories
@@ -93,6 +114,83 @@ module Dependabot
 
         private
 
+        sig do
+          params(
+            repository_url: String,
+            version: Dependabot::Version
+          ).returns(T.nilable(Time))
+        end
+        def fetch_pom_last_modified(repository_url:, version:)
+          # release.url is the exact repository URL recorded when the version was
+          # discovered, so an exact match is sufficient (no trailing-slash cleanup).
+          repository_details = repositories.find do |details|
+            self.repository_url(details) == repository_url
+          end
+
+          unless repository_details
+            Dependabot.logger.debug(
+              "No configured repository matches #{repository_url} for #{dependency.name}; " \
+              "skipping POM Last-Modified fallback"
+            )
+            return
+          end
+
+          response = Dependabot::RegistryClient.head(
+            url: dependency_pom_url(repository_url, version),
+            headers: repository_auth_headers(repository_details)
+          )
+          return unless response.status < 400
+
+          last_modified = response.headers["Last-Modified"] || response.headers["last-modified"]
+          return unless last_modified
+
+          released_at = Time.httpdate(last_modified)
+          log_fallback_hit(repository_url: repository_url)
+          Dependabot.logger.debug(
+            "Using POM Last-Modified fallback for #{dependency.name} version #{version} from " \
+            "#{repository_url}: #{released_at}"
+          )
+          released_at
+        rescue StandardError => e
+          Dependabot.logger.debug(
+            "Failed POM Last-Modified fallback for #{dependency.name} version #{version} from " \
+            "#{repository_url}: #{e.message}"
+          )
+          nil
+        end
+
+        sig { params(repository_url: String).void }
+        def log_fallback_hit(repository_url:)
+          return if @fallback_logged
+
+          Dependabot.logger.info(
+            "Using POM Last-Modified fallback release dates for #{dependency.name} from #{repository_url}"
+          )
+          @fallback_logged = true
+        end
+
+        sig do
+          params(
+            release: Dependabot::Package::PackageRelease,
+            released_at: Time
+          ).returns(Dependabot::Package::PackageRelease)
+        end
+        def build_release_with_date(release, released_at)
+          Dependabot::Package::PackageRelease.new(
+            version: release.version,
+            released_at: released_at,
+            latest: release.latest,
+            yanked: release.yanked,
+            yanked_reason: release.yanked_reason,
+            downloads: release.downloads,
+            url: release.url,
+            package_type: release.package_type,
+            language: release.language,
+            tag: release.tag,
+            details: release.details
+          )
+        end
+
         sig { returns(Maven::FileParser::RepositoriesFinder) }
         def repository_finder
           return @repository_finder if @repository_finder

data/lib/dependabot/maven/shared/base_version_finder.rb

@@ -75,12 +75,31 @@ module Dependabot
           possible_releases = filter_date_based_versions(possible_releases)
           possible_releases = filter_version_types(possible_releases)
           possible_releases = filter_ignored_versions(possible_releases)
-          possible_releases = filter_by_cooldown(possible_releases)
           possible_releases_reverse = possible_releases.reverse
 
-          possible_releases_reverse.find do |r|
-            released?(r.version)
+          return possible_releases_reverse.find { |r| released?(r.version) } unless cooldown_options
+
+          cooldown_filtered_releases = 0
+          latest_release = possible_releases_reverse.find do |release|
+            if in_cooldown_period?(release)
+              Dependabot.logger.info("Filtered out (cooldown) : #{release}")
+              cooldown_filtered_releases += 1
+              next false
+            end
+
+            released?(release.version)
           end
+
+          if cooldown_filtered_releases.positive?
+            Dependabot.logger.info(
+              "Filtered out #{cooldown_filtered_releases} version(s) due to cooldown"
+            )
+          end
+
+          latest_release ||= current_version_fallback_release(
+            possible_releases_reverse, cooldown_filtered_releases
+          )
+          latest_release
         end
 
         sig do
@@ -104,6 +123,34 @@ module Dependabot
 
         private
 
+        # When every candidate was filtered out by cooldown, stay on the current
+        # version (if released) instead of reporting no latest version at all.
+        sig do
+          params(
+            possible_releases: T::Array[Dependabot::Package::PackageRelease],
+            cooldown_filtered_releases: Integer
+          ).returns(T.nilable(Dependabot::Package::PackageRelease))
+        end
+        def current_version_fallback_release(possible_releases, cooldown_filtered_releases)
+          return if possible_releases.empty?
+          return unless cooldown_filtered_releases == possible_releases.length
+
+          current_version_str = dependency.version
+          return unless current_version_str
+
+          Dependabot.logger.info(
+            "All versions filtered by cooldown for #{dependency.name}, " \
+            "falling back to current version #{current_version_str}"
+          )
+
+          current_release = Dependabot::Package::PackageRelease.new(
+            version: version_class.new(current_version_str),
+            released_at: nil,
+            tag: nil
+          )
+          current_release if released?(current_release.version)
+        end
+
         sig { abstract.params(version: Dependabot::Version).returns(T::Boolean) }
         def released?(version); end
       end

data/lib/dependabot/maven/shared/shared_metadata_finder.rb

@@ -67,11 +67,24 @@ module Dependabot
 
         sig { params(pom: Nokogiri::XML::Document).returns(T.nilable(Dependabot::Source)) }
         def look_up_source_in_pom(pom)
-          potential_source_urls = [
-            pom.at_css("project > url")&.content,
-            pom.at_css("project > scm > url")&.content,
-            pom.at_css("project > issueManagement > url")&.content
-          ].compact
+          source_selectors =
+            if Dependabot::Experiments.enabled?(:prioritize_scm_source)
+              # Prefer scm url, followed by project url, and finally issue management url (#2084)
+              [
+                "project > scm > url",
+                "project > url",
+                "project > issueManagement > url"
+              ]
+            else
+              [
+                "project > url",
+                "project > scm > url",
+                "project > issueManagement > url"
+              ]
+            end
+          potential_source_urls = source_selectors.filter_map do |selector|
+            pom.at_css(selector)&.content
+          end
 
           source_url = potential_source_urls.find { |url| Source.from_url(url) }
           source_url ||= source_from_anywhere_in_pom(pom)

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -58,6 +58,20 @@ module Dependabot
           @package_details ||= package_details_fetcher.fetch
         end
 
+        protected
+
+        sig { override.params(release: Dependabot::Package::PackageRelease).returns(T::Boolean) }
+        def in_cooldown_period?(release)
+          return super if release.released_at
+          return false if Dependabot::UpdateCheckers::CooldownCalculation.skip_cooldown?(
+            cooldown_options,
+            dependency.name,
+            cooldown_enabled: cooldown_enabled?
+          )
+
+          super(package_details_fetcher.fetch_release_metadata(release: release))
+        end
+
         private
 
         sig { override.params(version: Dependabot::Version).returns(T::Boolean) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.392.0
+  version: 0.393.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.392.0
+        version: 0.393.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.393.0
 rdoc_options: []
 require_paths:
 - lib